I have a lot of respect for Jarred and bun. The lean approach of just one person working for a year is rather underrated imo. No funding and therefore no pressure for growth. No overhead from scaling up a team and having to implement process, standards, etc. And at the same time, incredible content marketing by just tweeting about every little detail. Me and many others got hooked just because Jarred was posting interesting stuff and kept posting interesting stuff. It wasn't a stuffy blog or padded out conference talks, it was just good, technical content.<p>My only hope is that Jarred gets some rest for a bit. According to his Twitter he's been pulling 80 hour weeks and while that does lead to impressive work, it's not great from a human perspective. Hope he can rest up and keep this going for the long haul!
It's an incredible achievement, though I worry about the use of an unproven language (Zig) that lacks memory safety by design. JavaScript runtimes, especially those with JITs, have been plagued by vulnerabilities from memory safety, type confusion, and data races.<p>Node.js, despite being based on V8, is still susceptible <i>independently</i> of V8 and introduces its own vulnerabilities. It's not sufficient for the runtime to be secure, but the new facilities Bun provides must <i>also</i> be vetted.<p>Bun/Oven are new, and similar in position to Node. Here are the hard questions I'd ask if I were on a security team and asked to review adopting Bun:<p>1. Will Oven adopt a security policy for Bun? (<a href="https://github.com/oven-sh/bun/security" rel="nofollow">https://github.com/oven-sh/bun/security</a>)<p>2. What measures is Oven taking to proactively detect and mitigate vulnerabilities? (e.g.: fuzzing, audits, bug bounties)<p>3. Will Oven support Zig development to avoid an existential risk in upstream vulnerabilities?
Related:<p><i>Will Bun JavaScript Take Node's Crown</i> - <a href="https://news.ycombinator.com/item?id=32457587" rel="nofollow">https://news.ycombinator.com/item?id=32457587</a> - Aug 2022 (321 comments)<p><i>Bun: A Complete Overhaul of the JavaScript Ecosystem</i> - <a href="https://news.ycombinator.com/item?id=32243534" rel="nofollow">https://news.ycombinator.com/item?id=32243534</a> - July 2022 (25 comments)<p><i>Bun gets “bun:FFI” – call native libraries from JavaScript</i> - <a href="https://news.ycombinator.com/item?id=32120090" rel="nofollow">https://news.ycombinator.com/item?id=32120090</a> - July 2022 (16 comments)<p><i>Bun (can become) the ideal JavaScript runtime</i> - <a href="https://news.ycombinator.com/item?id=32067268" rel="nofollow">https://news.ycombinator.com/item?id=32067268</a> - July 2022 (14 comments)<p><i>Bun: Fast JavaScript runtime, transpiler, and NPM client written in Zig</i> - <a href="https://news.ycombinator.com/item?id=31993429" rel="nofollow">https://news.ycombinator.com/item?id=31993429</a> - July 2022 (314 comments)<p><i>Bun – fast JavaScript and CSS bundler</i> - <a href="https://news.ycombinator.com/item?id=29179848" rel="nofollow">https://news.ycombinator.com/item?id=29179848</a> - Nov 2021 (36 comments)<p>Kind of related:<p><i>Hop: Faster than unzip and tar at reading individual files</i> - <a href="https://news.ycombinator.com/item?id=29178710" rel="nofollow">https://news.ycombinator.com/item?id=29178710</a> - Nov 2021 (128 comments)
Congrats to Jarred! Bun has blown me away in terms of performance. Often (in other projects) performance claims out of nowhere are simply cherry-picked but I’ve found bun repeatedly impressing me with both speed and elegance.<p>What doesn’t get mentioned enough is just how friggin ergonomic bun is. Install it and you’ll see what I mean immediately. Play with any API in the “bun:” namespace and it’s just a breath of fresh air.
My moneys on Just-JS.<p>It’s consistently in the top 5 fastest web framework (beating out Rust, etc).<p>Just-JS is already faster than Bun.<p>Additionally, JSCore appears to be a significant reason why Bun is faster than NodeJS (V8). Just-JS is investigating switching to JSCore as well - which will only extend its lead.<p><a href="https://github.com/just-js/just" rel="nofollow">https://github.com/just-js/just</a><p><a href="https://www.techempower.com/benchmarks/#section=data-r21" rel="nofollow">https://www.techempower.com/benchmarks/#section=data-r21</a><p><a href="https://twitter.com/justjs14/status/1560741923106725889#m" rel="nofollow">https://twitter.com/justjs14/status/1560741923106725889#m</a><p><a href="https://twitter.com/justjs14/status/1557856790897106944#m" rel="nofollow">https://twitter.com/justjs14/status/1557856790897106944#m</a>
While obviously extremely impressed with Bun and Jarred's achievement (especially because I really like Zig being similar to C) I'm also shocked that he was able to get a 3-letter `.sh` domain (bun) _and_ a 4-letter `.sh` domain (oven) both real words!<p>Looked to me that Oven was registered shortly after Bun exploded in popularity.
For those like me who didn't know:<p><a href="https://bun.sh/" rel="nofollow">https://bun.sh/</a>. "Bun is a fast all-in-one JavaScript runtime. Bundle, transpile, install and run JavaScript & TypeScript projects — all in Bun. Bun is a new JavaScript runtime with a native bundler, transpiler, task runner and npm client built-in."
finally, a tech company with a cute design aesthetic :D i'm so happy to see a cute little bun in an oven instead of standard tech company imagery. i've never used bun and don't have great reason to, but it makes me hopeful to see.
> Before Oven can offer hosting, Bun needs a stable release. The goal: a stable release of Bun in under six months from today (August 23rd).<p>Wow! That is an ambitious timeline. Also ambitious is this:<p>> The plan is to run our own servers on the edge in datacenters around the world. Oven will leverage end-to-end integration of the entire JavaScript stack (down to the hardware) to make new things possible.<p>That’s a lot of work in a crowded space. Maybe they’re aiming for an acquisition or something?<p>Anyway, I wish them luck. Bun probably tops the list of projects I’m excited about at the moment.
from the bun website
> Bun natively implements hundreds of Node.js and Web APIs, including ~90% of Node-API functions<p>Is there any status tracker to see what is supported and what is not, or in other words how do I know if bun supports a particular framework or a library?
Interesting effort. How do you plan to make money? I would love to do something like this but it must be really hard to figure how to turn revenue sustainably apart from donations, consulting and maybe some sort of hosting services.
I love these funny names. First time I introduced HomeBrew to my gf, she was all laughing at the funny terms:<p><pre><code> keg - Program binaries created from source
bottle - Program binaries downloaded
cellar - Directory where kegs / binaries are stored
tap - git repository
cask - macos native binary (not used in Linux)</code></pre>
Someone please translate this into non-buzzwordspeak:<p>> Oven will leverage end-to-end integration of the entire JavaScript stack (down to the hardware) to make new things possible.
"Oven, the company behind Bun, has raised $7m in funding"<p>"Oven will provide incredibly fast serverless hosting & continuous integration for backend & frontend JavaScript apps"<p>Isn't trying to dethrone node.js (by making Bun better and more popular) something worth pursuing on its own, or there is no money in that?